User authentication method, evaluation device, non-transitory computer-readable storage medium, and user authentication system

An evaluation device, comprising:

• a receiver part that receives via a public network, from an authentication device that performs a login authentication of a user by using a user identification and a password for identifying the user, a hash value of the user identifier, the hash value being generated in a terminal unit used for the login by the user, and information that indicates a login environment of the terminal unit, the information being encrypted in the terminal unit;
• a decoding part that decodes the encrypted information that indicates the login environment of the terminal unit;
• a risk calculation part that calculates an evaluation value that indicates a risk of the login being an unauthorized access based on a statistic related to a degree of similarity between the login environment of the terminal unit and a previous login environment by the user corresponding to the hash value;
• and
• a transmitter part that transmits, to the authentication device, a comparison result between the calculated evaluation value and a predetermined threshold;
• wherein the receiver part receives a notification, from the authentication device, that indicates that an additional authentication is successful, the additional authentication being performed by the authentication device if the comparison result indicates that the risk of unauthorized access is high;
• the evaluation device further comprising a list management part that stores in a successful authentication list, a combination of (i) the login environment of the terminal unit when the additional authentication is successful and (ii) the hash value;
• and
• the risk calculation part transmits, to the authentication device, information that indicates that the login should be accepted, if a combination of the hash value and the login environment of the terminal unit acquired in the information receiving is included in the successful authentication list.

A non-transitory computer-readable storage medium storing a computer program for making a computer perform functions of:

• receiving via a public network, from an authentication device that performs a login authentication of a user by using a user identification and a password for identifying the user, a hash value of the user identifier, the hash value being generated in a terminal unit used for the login by the user, and information that indicates a login environment of the terminal unit, the information being encrypted in the terminal unit;
• decoding the encrypted information that indicates the login environment of the terminal unit;
• calculating an evaluation value that indicates a risk of the login being an unauthorized access based on a statistic related to a degree of similarity between the login environment of the terminal unit and a previous login environment by the user corresponding to the hash value;
• transmitting, to the authentication device, a comparison result between the calculated evaluation value and a predetermined threshold;
• receiving a notification, from the authentication device, that indicates that an additional authentication is successful, the additional authentication being performed by the authentication device if the comparison result indicates that the risk of unauthorized access is high,
• storing, in a successful authentication list, a combination of (i) the login environment of the terminal unit when the additional authentication is successful and (ii) the hash value;
• and
• transmitting to the authentication device, information that indicates that the login should be accepted, if a combination of the hash value and the login environment of the terminal unit acquired in the information receiving is included in the successful authentication list.

A user authentication system, comprising:

• an authentication device that authenticates a login by using a user identification and a password for identifying a user via a terminal unit used by the user;
• and
• an evaluation device that evaluates a risk of the login being an unauthorized access,
• wherein the authentication device includes:
• a communication part that communicates with the terminal unit and the evaluation device via a public network;
• and
• an authentication part that authenticates the login by the user via the terminal unit used by the user,
• wherein the evaluation device includes:
• a receiver part that receives, from the authentication device via the network, a hash value of the user identifier for identifying the user, the hash value being generated in the terminal unit, and information that indicates a login environment of the terminal unit, the information being encrypted in the terminal unit;
• a decoding part that decodes the encrypted information that indicates the login environment of the terminal unit;
• a risk calculation part that calculates an evaluation value that indicates the risk, the evaluation value being calculated based on a statistic related to a degree of similarity between the login environment of the terminal unit and a previous login environment by the user corresponding to the hash value;
• and
• a transmitter part that transmits, to the authentication device via the network, a comparison result between the calculated evaluation value and a predetermined threshold, and
• wherein the authentication device further includes an additional authentication part that performs an additional authentication on the user when the comparison result acquired from the evaluation device indicates that the risk of unauthorized access is high;
• wherein the receiver part receives a notification that indicates that the additional authentication is successful if the additional authentication of the user is successful;
• the evaluation device further comprising a list management part that that stores in a successful authentication list, a combination of (i) the login environment of the terminal unit when the additional authentication is successful and (ii) the hash value;
• and
• the risk calculation part transmits, to the authentication device, information that indicates that the login should be accepted, if a combination of the hash value and the login environment of the terminal unit acquired in the information receiving is included in the successful authentication list.